Senior GRC Leader - AI-Driven Security & Compliance

Virta Health; Denver, San Francisco (CO, CA); Hybrid; USD 162,000 - 209,000; Full time

Job summary

Virta Health is seeking a Senior Manager of GRC to lead governance, risk, and compliance in a highly automated, AI-first environment. You will champion security controls, partner with Sales on enterprise security reviews, and drive risk-based decision making across the organization.

You will manage policy lifecycles, risk assessments, and program maturity while enabling frictionless SaaS reviews for internal teams, vendors, and customers.

Qualifications

• 7+ years of dedicated experience in Cybersecurity GRC, IT Auditing, or Information Security Compliance, with team leadership in regulated environments.
• Direct experience with HITRUST CSF, HIPAA, and SOC 2.
• Proven ability to automate compliance processes using SaaS GRC tools.

Responsibilities

• Maintain and mature Virta Health’s information security compliance program, policies, procedures, and controls.
• Oversee GRC function and automate continuous evidence collection with Vanta.
• Partner with Sales to navigate enterprise security reviews and RFPs.
• Define policy lifecycle, risk assessments, and exception management.
• Design frictionless ticketing workflows and SLA for access governance and SaaS reviews.
• Collaborate with IT, Security Engineering, and Product Development to align GRC with technical architectures.

Skills

GRC leadership

IT Auditing

Information security compliance

Sales alignment

AI-enabled workflows

risk assessment

cross-functional leadership

Tools

Vanta

Drata

Job description

Virta Health is seeking a Senior Manager of GRC to lead governance, risk, and compliance in a highly automated, AI-first environment. You will champion security controls, partner with Sales on enterprise security reviews, and drive risk-based decision making across the organization.

You will manage policy lifecycles, risk assessments, and program maturity while enabling frictionless SaaS reviews for internal teams, vendors, and customers.